CVE-2026-35370CWE-863

uutils coreutils id Incorrect Access-Control Decisions via Misrepresented Group Membership

Medium · published April 22, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00127 · 2.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-04-22T16:08Z
EPSS history
Timeline
  • 22 APR 16:08Z
    uutils coreutils id Incorrect Access-Control Decisions via Misrepresented Group Membership
    cvelistv5